Static task
static1
Behavioral task
behavioral1
Sample
230406-bzj2fsaf74.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
230406-bzj2fsaf74.exe
Resource
win10v2004-20240226-en
General
-
Target
230406-bzj2fsaf74
-
Size
639KB
-
MD5
3c0447a8e05bc9ed43128ed22c22e23a
-
SHA1
0bf74262d4f57a3461088e1d96045ebbdeb43c21
-
SHA256
59ec54fb9b1d3415b54558977e3640b81bb3ebebdb61af3fc772e308c6b8eb3a
-
SHA512
f4ec59d7445ceabf7fe8fcd8be7752b5ae6db4a68bcf53d73419d515131f86c7eb8893999c9c60569f2b4f8fb27f5c1457c3177476c4dad6489fb15591c9fa44
-
SSDEEP
12288:2jZfZfZfZfZfZfZOZ2XsHUKwbNWuTncBxPMRS8SUC9H4jlNEz9vBiptAE43/:2jZfZfZfZfZfZfZOZ2XsHUK8ni0U8SU0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 230406-bzj2fsaf74
Files
-
230406-bzj2fsaf74.exe windows:5 windows x86 arch:x86
46ec036f108b9442762024102130efcd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
Imports
nddeapi
NDdeShareAddA
NDdeShareDelA
NDdeShareGetInfoA
kernel32
GetModuleFileNameA
lstrcmpiA
GetDateFormatW
GetModuleHandleW
GetProcAddress
CreateMailslotW
GetLogicalDriveStringsW
ReadConsoleW
WaitForSingleObject
InitializeCriticalSection
LoadLibraryA
GetConsoleAliasA
GetFileAttributesW
DeleteFileW
SearchPathA
GetACP
GetCommandLineA
CreateFileMappingA
SetErrorMode
advapi32
RegEnumKeyA
RegReplaceKeyW
RegUnLoadKeyA
OpenEventLogA
ClearEventLogW
RegLoadKeyA
LogonUserW
RegCreateKeyExW
InitializeAcl
CryptSignHashW
ControlService
RegDeleteValueA
RegOpenKeyA
shell32
FindExecutableW
SHGetFileInfoW
StrStrA
StrChrW
ShellAboutW
ExtractIconW
SHGetFolderPathA
DllRegisterServer
SHCreateShellItem
SHFree
user32
GetClassLongW
LoadBitmapW
CreateDesktopA
wsprintfA
PostMessageW
GetDlgItemTextW
IsDialogMessageA
DispatchMessageA
GetMessageA
LoadMenuA
LoadStringA
LoadIconW
DialogBoxParamA
CharToOemA
DrawStateA
InsertMenuW
GetPropW
Sections
.text Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 553KB - Virtual size: 553KB
IMAGE_SCN_MEM_READ